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ABSTRACT 

We present a quasipolynomial-time algorithm for solving 
the weak membership problem for the convex set of sepa- 
rable, i.e. non-entangled, bipartite density matrices. The 
algorithm decides whether a density matrix is separable or 
whether it is e-away from the set of the separable states 
in time exp(0(e~ 2 log \A\ log j-Bj)), where \A\ and \B\ are 
the local dimensions, and the distance is measured with ei- 
ther the Euclidean norm, or with the so-called LOCC norm. 
The latter is an operationally motivated norm giving the 
optimal probability of distinguishing two bipartite quantum 
states, each shared by two parties, using any protocol formed 
by quantum local operations and classical communication 
(LOCC) between the parties. We also obtain improved al- 
gorithms for optimizing over the set of separable states and 
for computing the ground-state energy of mean-field Hamil- 
tonians. 

The techniques we develop are also applied to quantum 
Merlin- Arthur games, where we show that multiple provers 
are not more powerful than a single prover when the verifier 
is restricted to LOCC protocols, or when the verification 
procedure is formed by a measurement of small Euclidean 
norm. This answers a question posed by Aaronson et al. 
(Theory of Computing 5, 1, 2009) and provides two new 
characterizations of the complexity class QMA, a quantum 
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analog of NP. 

Our algorithm uses semidefinite programming to search 
for a symmetric extension, as first proposed by Doherty, 
Parrilo and Spedialieri (Phys. Rev. A, 69, 022308, 2004). 
The bound on the runtime follows from an improved de 
Finetti-type bound quantifying the monogamy of quantum 
entanglement. This result, in turn, follows from a new lower 
bound on the quantum conditional mutual information and 
the entanglement measure squashed entanglement. 

1. INTRODUCTION 

A central problem in quantum information theory is to 
characterize entanglement in quantum states shared by two 
or more parties 23 . A bipartite density matrix, or state, 
is a positive semidefinite matrix pab on the tensor product 
AB = A ® B of finite dimensional complex vector spaces 
that is normalized, meaning tr(pAs) = 1- Such a state is 
separable if it can be written as pab = ~^2 k PkPA,k ® pB,k, 
for local states pA,k and ps,k and probabilities p k . Any sep- 
arable state can be created by local quantum operations and 
classical communication (LOCC) by Alice and Bob and thus 
only contains classical correlations. Quantum states that are 
not separable are called entangled. As the normalized Her- 
mitian matrices on AB form a real vector space of dimension 
d = \A\ 2 \B\ 2 - 1 (we abbreviate dim(A) = \A\), the set of 
all states can be viewed as a compact, convex subset of R d 
containing the convex subset S = Sa-.b of separable states. 

A fundamental question is to decide, given a description 
of pab (say, as a rational vector in R d ) whether or not it 
is separable |23l 1131 25, 18, 16, 19] . i.e. whether or not it is 
contained in S. This can be formalized as a decision problem 
via the weak membership problem. Given a norm || * || on R d 
and a closed subset A C R d , let \\p — A\\ = min (Tg .A \\p — a\\ 
be the distance from p to A. 

Problem 1. W / sep(e, | * ||) (Weak membership prob- 
lem FOR separability): Given a density matrix pab with 
the promise that either (i) pAB £ S or (ii) \\pab — S\\ > e, 
decide which is the case. 

This problem has been intensely studied in recent years 
(see e.g. [23l [131 [25l LTH1 LTSl [19] ) with the norm given either 
by the Euclidean norm ||A|| 2 = tr(A f A) 1/2 or by the trace 
norm ||A||i = trVJOX. 

The best-known algorithms for W S Ep(e, || * ||) [E2G5] (with 
the norm equal either to Euclidean or trace norm) have 
worst-case complexity exp (O (|j4| 2 |-B| 2 log(e -1 )))). On the 
hardness side, Gurvits [18] proved that WsEp(e, | * H2) is 



NP-hard for e = exp(-0(d)), with d = y/\A\ ■ \B\; the de- 
pendence on e was later improved to e = 1/ poly(d) [16]. 
The same results apply to the trace norm, since for every 
I x I matrix, ||X||i > ||X|| 2 > r 1/2 ||X||i. 

A second problem closely related to the weak-membership 
problem for separability is the following: 

Problem 2. BSS(e) (Best Separable State): Given 
a Hermitian matrix M on AB, estimate maxo-gs tr(Mc) 
with additive error e. 

The BSS(e) problem thus consists of optimizing a linear 
function over the convex set of separable states S. It is a 
standard fact in convex optimization [17] that linear opti- 
mization and weak-membership over a convex set are equiv- 
alent tasks, which implies that BSS(e) can be used to solve 
Wsep(<5, II * II) and vice- versa, up to a poly(d) loss in the er- 
ror parameters e and 8 (see [25] for a detailed analysis). The 
best known algorithm for BSS(e) has worst-case complexity 
exp (O ((\A\ + IBDHMIIao log(e _1 )))[H The NP-hardness of 
the weak-membership problem for separability implies that 
BSS(e) is NP-hard for e = l/poly(d). Conditioned on 
the stronger assumption that there is no subexponential- 
time algorithm for 3-SAT 24', Harrow and Montanaro [19] . 
building on work by Aaronson et al. pQ, recently ruled out 
even quasipolynomial-time algorithms for BSS(e) of com- 
plexity up to exp (O (log 1- " \A\ log 1 '" IBIUMIloo)) for con- 
stant e and any v + p, > 0. More specifically, they showed 
one could solve 3-SAT with n clauses by solving BSS(e), 
with constant e, for a matrix < M < I on AB with 
\A\ = \B\ = 2 °(^P ol >- lo g(")). Indeed, this shows that an 
algorithm for BSS(e) with time complexity 

exp(0 (log 1 -" |A| Ipg 1 -" |B|||Af||oo)) 



l-(„+ M )/2 



poly log(n)) ) -time algo- 



would imply an exp yO(n" 

rithm for 3-SAT. 

The best separable state problem has a number of other 
applications (see e.g. [S]), including the estimation of the 
ground-state energy of mean-field quantum Hamiltonians 
and estimating the minimal min-entropy of quantum chan- 
nels. In entanglement theory, it has been studied under 
the name of optimization of entanglement witnesses (see e.g. 
[231)0 

It turns out that the problem BSS(e) is also intimately 
connected to quantum Merlin- Arthur games with multiple 
Merlins. The class QMA is a quantum analog of NP and 
is formed by all languages that can be decided in quantum 
polynomial-time by a verifier who is given a quantum sys- 
tem of polynomially many qubits as a proof (see e.g. |33|). 
The class QMA(2), in turn, is a variant of QMA in which 
two proofs, not entangled with one another, are given to 



||M||oo is the operator norm of M, given by the maxi- 
mum eigenvalue of V MtM. 

2 The algorithm is nothing more than exhaustive search, 
in which for an op erator M with ||JVf)|oo < 1, one 
considers e-nets |20l Lemma II. 4] {|afe)}fc and {|bfc)}j 
for the A and B systems of sizes exp (0(|Aj log(e -1 ))) 
and exp (0(|B| log(e -1 ))) , respectively, and minimize 
(a u ,bj\M\a k ,bj) over k,j. 

3 An entanglement witness W is a Hermitian operator 
which has positive trace on all separable states and a neg- 
ative trace on a particular entangled state, thus witnessing 
the fact that the state is entangled. 



the verifier [27]. The properties of QMA(2) and its rela- 
tion to QMA have recently been in the center of interest in 
quantum complexity theory [H[27][T]|1|331[S][21[1]|1]. 
As shown in [19] . the optimal acceptance probability of a 
QMA(2) protocol can be expressed as a BSS(e) instance. 
Thus a better understanding of the latter would also shed 
light on the properties of QMA(2). 

2. RESULTS 

A quasipolynomial-time algorithm for separability: 

Our main result is a quasipolynomial-time algorithm for 
W / SEp(e, || * ||), for two different choices of the norm: 

Theorem 1. WsKp(e, \\*h) and WsEp(e, || * ||locc) can 
be solved in exp(0(e -2 log \ A\ log |-B|)) time. 

The norm || * ||[_occ ^n be seen as a restricted version of 
the trace norm || * Hj. The latter can be written as 

\\XL = max tr((2M-I)X), 

1 0<Af<I 

where I is the identity matrix, and is of special importance 
in quantum information theory as it is directly related to 
the optimal probability for distinguishing two equiprobable 
states p and a with a quantum measurement Q In analogy 
with this interpretation of the trace norm, we define the 
LOCC norm as [3DJ 



\X 



, nrr := max tr((2M - IVX), 

LUC( - AfeLOCC ^ ' ' 



where LOCC is the convex set of matrices < M < I such 
that there is a two-outcome measurement {M, I — M} that 
can be realized by LOCC0 The optimal bias in distinguish- 
ing p and a by any LOCC protocol is then |||p — cr|| L0CC . We 
note that in many applications of the separability problem, 
e.g. assessing the usefulness of a quantum state for violating 
Bell's inequalities or for performing quantum teleportation, 
the LOCC norm is actually the more relevant quantity to 
consider. 

The Euclidean, or Frobenius norm ||X|| 2 := ti{X' X) is 
the negative exponential of the quantum collision entropy, 
and is often of interest in quantum information theory be- 
cause its quadratic nature makes it especially easy to work 
with. 

The algorithm for testing separability, which we present 
and analyze in more detail in Section [3] is very simple and 
searches for symmetric extensions of the state using semidef- 
inite programming. The search for symmetric extensions us- 
ing semidefinite programming as a test of separability has 
first been proposed by Doherty, Parillo and Spedalieri [13] . 

A quasipolynomial-time algorithm for Best Separa- 
ble State: The same method used to prove Theorem [T] also 
results in the following new algorithm for BSS(e): 

4 Two-outcome measurements suffice for such tasks, and 
these are described by a pair of positive semidefinite matrices 
summing to I, which we write {M, I — M}. When the state 
is p, the probabilities of the outcomes are Pr(M) = tr(Mp) 
and Pr(I — M) = tr((I - M)p) = 1 - Pr(Af). The optimal 
bias of distinguishing two states p and a is then given by 
max <M<itr(M(p — a)) = |||p — <r||i. 

5 This defines a norm because the set of operators 2M — I 
is convex, closed, symmetric about the origin and has 
nonempty interior. Therefore it is the unit ball for a norm 
whose corresponding dual norm is equal to || * II uocc- 



Theorem 2. There is an algorithm solving BSS(e) for 
the Hermitian operator M in time 

exp (O (e- 2 log|A|log|B|||M||^)). 

Furthermore, there is an exp (0(e -2 log \A\ log \B\)) -time al- 
gorithm solving BSS(e) for any M such that {M, I — M} is 
an LOCC measurement. 

It is intriguing that the complexity of our algorithm for 
LOCC operators M matches the hardness result of Harrow 
and Montanaro for general operators, which shows that a 
subexponential-time algorithm of complexity up to 

exp (O (log 1 "" \A\ log 1 "" |B|||Af||oo)) 

for constant e and any v + p > would imply a exp (o(n)) 
algorithm for SAT with n clauses It is an open question if 
a similar hardness result could be obtained for LOCC mea- 
surements, which would imply that our algorithm is optimal, 
assuming SAT requires exponential time. 

An application of Theorem [2] concerns the estimation of 
the ground state energy of mean- field Hamiltonians. A mean- 
field Hamiltonian consists of a Hermitian operator acting on 
n sites (each formed by a d-dimensional quantum system) 
defined as H := ~ 23 4< . Kij, with Kij given by the Her- 
mitian matrix which acts as K on sites i and j (for a fixed 
two-sites interaction K) and as the identity on the remaining 
sites. Mean-field Hamiltonians are often used in condensed- 
matter physics as a substitute for a given local Hamiltonian, 
since they are easier to analyze and in many cases provide 
a good approximation to the true model. 

An important property of quantum many-body Hamilto- 
nians is their ground-state energy, i.e. their minimal eigen- 
value. A folklore result in condensed-matter physics, for- 
malized e.g. in [TS], is that the computation of the ground- 
state energy of a mean-field Hamiltonian H is equivalent to 
the minimization of ti(aK) over separable states a £ Sa-.b 
with \A\ = \B\ — d. Theorem [2] then readily implies a 
exp (O (e -2 log 2 (d)||A"|||))-time algorithm for the problem. 
Before, the best-known algorithrrQ scaled as 

exp (n (dWKW^logie- 1 ))) . 

Monogamy of entanglement and LOCC norm: We 

say that a bipartite state pa-.b is fc-extendible if there is 
a state PA-.B 1 ---B k that is permutation-symmetric in the B 
systems with pa-.b = tTB 2 ---B k (pA-.B 1 -~B k )- The sets of k- 
extendible states provide a sequence of approximations to 
the set of separable states. In the limit of large fc, the ap- 
proximation becomes exact because a state is separable if, 
and only if, it is fc-extendible for every k (see e.g. [9]). This 
result is a manifestation of a property of quantum corre- 
lations known as monogamy of entanglement: a quantum 
system cannot be equally entangled with an arbitrary num- 
ber of other systems, i.e. entanglement is a non-shareable 
property of quantum states. 

In a quantitative manner, quantum versions of the de 
Finetti theorem imply that for any fc-extendible state pa-.b'- 

6 In fact, the operator M c an be taken to be a non- 
normalized separable state [IS]. This, however, does not 
imply that it can be implemented by LOCC. 

7 The algorithm again simply searches for the minimum 
overlap of K over an e-net in the set of product states. 



\\PA-.b - S\\x < 4\B\ 2 k x |9 Moreover, this bound is close to 
tight, as there are fc-extendible states that are S7(|i3|fc _ )- 
away from the set of separable states Unfortunately, for 
many applications this error estimate - exponentially large 
in the number of qubits of the state - is too big to be useful. 
The key result behind Theorems [TJ and [2] is the following 
de Finetti- type result, which shows that a significant im- 
provement is possible if we are willing to relax our notion of 
distance of two quantum states: 

Theorem 3. Let pa-.b be k-extendible. Then 

||pA: fl -«S|| L0cc <O(fc- 1 log| J 4|)'. 

In [30] it was shown that ||X||locc > V153 H^IU' so we a ^ so 
have a similar bound for the Euclidean norm, namely 

||P-4: S -«S|| 2 <0(fc- 1 l0g|^|) i (1) 

A direct implication of Theorem [3] concerns data-hiding 
states [TU [TTJ [T3] [5TJ. Every state p that can be well- 
distinguished from separable states by a global measure- 
ment, yet is almost completely indistinguishable from a sep- 
arable state by LOCC measurements is a so-called data- 
hiding state: it can be used to hide a bit of information 
(whether the prepared state is p or the closest separable 
state to p in LOCC norm) that is not accessible by LOCC 
operations alone. The bipartite antisymmetric state of suf- 
ficiently high dimension is an example of a data hiding state 
[14] . as are random mixed states with high probability |21j 
(given an appropriate choice of the dimensions and the rank 
of the state). Theorem|3]shows that highly extendible states 
that are far away in trace norm from the set of separable 
states must necessarily be data-hiding. 

Quantum Merlin- Arthur games with multiple Mer- 
lins: A final application of Theorem [3] concerns the com- 
plexity class Quantum Merlin- Arthur (QMA), the quantum 
analogue of NP (or more precisely of MA). It is natural 
to ask how robust the definition of QMA is and a few re- 
sults are known in this direction: For example, it is possible 
to amplify the soundness and completeness parameters to 
exponential accuracy, even without enlarging the proof size 
[29] . Also, the class does not change if we allow a first round 
of logarithmic-sized quantum communication from the ver- 
ifier to the prover [3]. 

From Theorem [5] we get a new characterization of QMA, 
which at first sight might appear to be strictly more pow- 
erful: We show QMA to be equal to the class of languages 
that can be decided in polynomial time by a verifier who 
is given fc unentangled proofs and can measure them using 
any quantum polynomial-time implementable LOCC proto- 
col among the fc proofs. This answers an open question of 
Aaronson et al. [TJ. We hope this characterization of QMA 
proves useful in devising new QMA verifying systems. 

In order to formalize our result, let M be a class 
of two-outcome measurements and consider the classes 
QMA M (fc) m ,s,c, defined in analogy to QMA as follows [271 

EDO!: 

8 The quantum de Finetti theorem in [9] says that 
given a (fc + l)-partite quantum state Pab x B k in- 
variant under exchange of the systems B i: there is a 
measure p on quantum states on system B such that 
\\pAB 1 ,...,B l - j p{do)^ A ® a Bl ® ■ ■ ■ ® ctb, ||j < 4d 2 Z/fc. 



Definition 1. A language L is in QMA M (fc)„ liSiC if there 
is a uniform family of polynomial-sized quantum circuits 
that, for every input x £ {0, 1}™, can implement a two out- 
come measurement {M x ,l — M x } from the class M such that 

• Completeness: If x £ L, there exist k witnesses 
\lpl },..., \lpk), each of m qubits, such that 

tr(Ma(|^i)(V>i|®---(g>|V>iO(^*l)) > c - 

• Soundness: If x ^ L, then for any states l^i}, ■ • ■ , jV'fc) 

tr (M x (|V>i)(V>i| ® ■ • ■ ® |-0fc> <"0te|)) < s. 

We call QMA M (fc) = QMA M (fc) poly(n)i2 /3,i/3- By a uniform 
family, we mean that there should be a classical algorithm 
which, upon given the input length n and the string x, out- 
puts a description of the quantum circuit implementing the 
measurement {M x ,l — M x } in time 0(poly(n)). 

Let SEPyes be the class of two outcome POVMs {M, 1-M} 
such that M, the POVM element corresponding to accept, 
is a (non-normalized) separable operator. Harrow and Mon- 
tanaro showed that 

QMA SEPyes (2) = QMA(2) = QMA(fc) 

for any k = poly(n) [19J . i.e. two proofs are just as power- 
ful as k proofs and one can restrict the verifier's action to 
SEPyes without changing the expressive power of the class. 

We define QMA L0CC (fc) in an analogous way, but now the 
verifier can only measure the k proofs with a LOCC mea- 
surement. Then we have, 

Theorem 4. For k = 0(1), 

QMAlqccO) = QMA. (2) 

In particular, 

QMA L0C c(2) m , s ,c C QMA 0(m2e - 2)|S+ejC . (3) 

A preliminary step in the direction of Theorem[4]appeared 
in [5], where a similar result was shown for QMA L0 (fc), a 
variant of QMA(fc) in which the verifier is restricted to im- 
plement only local measurements on the k proofs and jointly 
post-process the outcomes classically^ 

It is an open question whether Eq. ([3]) remains true if we 
consider QMA(2) instead of QMA L0CC (2). If this turns out 
to be the case, then it would imply an optimal conversion of 
QMA(2) into QMA in what concerns the proof length (under 
a plausible complexity-theoretic assumption). For it follows 
from [19] (based on the QMA(y / n polylog(n)) log ( n ) 1 /3 !l pro- 
tocol for 3-SAT with n variables of [TJ) that unless there is 
a subexponential-time quantum algorithm for 3-SAT, then 
there is a constant eo > such that for every <5 > 0, 

QMA(2) m , a , c g QMA o(m2 - 5)iS+e0iC . 

Recently Chen and Drucker 8 showed that a variant of 
the 3-SAT protocol from 1 can be implemented with only 
local measurements, showin eFI that 3-SAT is in 

Q M A L0CC ( sfii polylog (n) ) log 

(n), 1/3,2/3- 

9 QMA L0 (fc) is also called BellQMA(fc) [I] since the verifier 
is basically restricted to perform a Bell test on the proofs. 

10 In fact they proved the stronger statement that 3-SAT 
is in QMA LO ( v 4xpolylog(n)) log( „ )il/ 3 i 2/3. 



It is an intriguing open question if one could also obtain 
a QMA LO cc(2) protocol with the same total proof length 
(0(^/n polylog(n))), which would imply that the reduction 
from QMA L0CC (2) to QMA given in Theorem Q] cannot be 
improved, unless there is a subexponential time quantum 
algorithm for SAT. 

We will now give a characterization of QMA in terms 
of protocols for multiple provers with a restriction on 
the Euclidean norm of the verifiers measurements. Let 
QMA LO w,no(fc) be defined as above, with LOW the class of 
measurements {M, 1 — M} for which || || 2 < poly(n), but 
with such a restriction imposed only on the no instances of 
the language. 

Definition 2. A language L belongs to QMA L0W no (fc) if 
there is a uniform family of quantum circuits that, for ev- 
ery x € {0, l} n , can implement a two-outcome measurement 
{M X ,I — M x } such that 

• Completeness: If x £ L, there exist k witnesses 
\4>i), . . . , \ipk) , each o/poly(n) qubits, such that 

tr(M a ,(|V>i)<?/>i|® — ® |^fc)(V>fc|)) > ~- 

• Soundness: If x L, then \\M X \\2 < poly(n) and for 
any states \ipi), ■ ■ ■ , \ipk) 

tT(M a ,(\ip 1 }{ip 1 \®---^\i) k }(ip k \)) < i. 

Then we also have 

Theorem 5. For k = 0(1), 

QMA LOW ,n (fc) = QMA. 

It is an open question whether Theorems [4] and [5] hold for 
nonconstant k, say for k = 0(poly(n)). Our methods fail 
to achieve this because the quadratic blowup in the proof 
size inherent to our proofs prevents us from applying the 
reduction recursively more than a constant number of times. 

Existence of disentanglers: An interesting approach to 
the QMA(2) vs. QMA question concerns the existence of dis- 
entangler superoperators "1 , defined as follows: A superop- 
erator A : S — > A <g> B is an (log \S\, e, <5)-disentangler in the 
|| * || norm if 

• A(p) is e-close to a separable state for every p, and 

• for every separable state a, there is a p such that A(p) 
is 5-close to a. 

As noted in pQ, the existence of an efficiently implementable 
(poly(log |j4|, log |-Bj), e, <5)-disentangler in trace norm (for suf- 
ficiently small e and S) would imply QMA(2) = QMA. Wa- 
trous has conjectured that this is not the case and that for 
every e,5 < 1, any (e, 5)-disentangler (in trace-norm) re- 
quires \S\ = 2 n ^ A ^ . 

Theorem [3] readily implies that the LOCC-norm analog of 
Watrous' conjecture fails: there is an efficient disentangler 
in LOCC norm. Indeed, let k = Q, (<T 2 log | A\) and S := 
a ® 61 <S> • • • <g> bfc. Define the superoperator A : S — > A ® B, 
with \A\ = |a| and |S| = \bj\ for all j < k, as 

1 k 

A(p abl ... bk ) := T/ZPah- 



Then A is a (0(e -2 log \A\ log e, 0)-disentangler in LOCC 
norm. 

A lower bound on conditional mutual information: 

The main technical tool we use for obtaining Theorem[3]is a 
new lower bound on the quantum conditional mutual infor- 
mation of tripartite quantum states pabe, which might be 
of independent interest. The conditional mutual information 
is defined as 

I {A; B\E) P := H(AE) P + H{BE) P - H{ABE) P - H(E) P , 

where H(X) P := — tr(px log px) is the von Neumann en- 
tropy. Then we have the following analog of Pinsker's in- 
caualit\T n 1: 



Theorem 6. For every pabe, 
1 



I{A;B\E) P > 



5 In 2 



\\PA:B 



LOCC 



Theorem [6] leads to a new result concerning the entangle- 
ment measure squashed entanglement [10] . defined as 

E sq {pA-.B) = inf {\I{A\B\E) : pabe extension of Pab}- 

An immediate corollary of Theorem [S] is then 

Corollary 1. For every pab, 

1 „ 



E aq (pA:B) > 



I glrT2ll^ :S -<S]| L0CC . 



In particular, this implies that squashed entanglement is 
faithful, meaning it is strictly positive on all entangled states. 
This had been a long-standing conjecture in entanglement 
theory. 

3. PROOFS 

We now give complete proofs of our theorems with the 
exception of Theorem [6] for which we give a brief outline of 
the proof strategy. A complete proof can be found in [6]. 
We begin with a brief proof of Theorem [3] which itself is the 
key for the complexity-theoretic results. 

Proof of Theorem [3] This theorem is a simple com- 
bination of Corollary [1] and the following monogamy rela- 
tion for squashed entanglement: For every bipartite state 
PA:B 1 - B k [26]: 

k 

logflAI) > E sq (pA:B x -B k ) >^2E sq ( P A: Bj ). 

3=1 

This and Corollary [T] give the proof. □ 

Proof of Theorem [TJ We prove the statement for the 
LOCC norm. The Euclidean norm case follows by the same 
argument, replacing each application of Theorem [3] by Eq. 

The idea of the algorithm, which is also the basic idea 
of the algorithm from |13j . is to formulate the search for a 
O (eT 2 log | ^4 1) -extension of pab as a semidefinite program 
(SDP) 31 . If pab is separable then such an extension ex- 
ists because separable states have a fc-extension for every fc. 
Otherwise if \\pab — <S|| L0CC > e , n ° such extension exists by 
Theorem [3] We only have to make sure that the precision 

11 Pinsker's inequality for the relative entropy implies that 
I(A;B) > aibllPAs -pa®Pb\\\. 



of the algorithm solving the SDP is good enough, which we 
now analyze in detail. 

Consider the following semidefinite program, with ta-.b = 
1/{\A\\B\) the maximally mixed state. 6 '■= c/2 and pab,S '■ = 

(1 - 5)pA:B + STA:B, 



max tr(A" J 4 s, - b, ) subject to: ' 3- 

X ik/ Xa-.b, < 



X~A:Bi---B k > 

PAB.S Vj. 



(4) 



We introduced pab,s as we require a non-negligible bound 
on the minimum eigenvalue of the state. Observe that pab,s 
has a fc-extension precisely when the solution of Q is 1, in 
which case the extension is obtained by symmetrizing the B 
parts of X, i.e. by replacing X with the operator 

where the sum is over permutations. 

We now consider the approximate case. Define 

T := {X A:Bl ... Bk ■ X > 0,X A : Bj < Pa-.b,s Vj G [k]} 

as the set of feasible points and T v its i/-interior, i.e. 



T„ := {X 



A:B ± - 



X + H G J" for all H s.t. ||#|| 2 < v}. 



The use of Frobenius norm in the definition of T v is com- 
pletely independent of the norm in the theorem statement. 
Rather, it ensures the ellipsoid algorithm solves problem Q 
up to additive error v in time poly(|yl||_B| fc , log(^ -1 )) as long 
as Jv is nonempty (see e.g. [34] and references therein). We 
claim that T v is nonempty when v := exp(— \A\ |_B|e -2 ) and 
k = 0(eT x log \A\). Before proving this, let us show how it 
implies that we can solve the weak-membership problem for 
separability by solving Q. 

Suppose first that pa-.b is separable. Convexity of 5 im- 
plies that pa-.b,s is also separable, so we know there is a 
symmetric extension PA-.B 1 ---B k ,s of Pa-.b,5- The ellipsoid al- 
gorithm applied to problem (|4]) will therefore return a num- 
ber bigger than 1 — v. 

Suppose now that pa-.b is e-away from S. Then pa-.b.s is 
e/2-away from 5. By Theorem[3] any state pa-.b that is e/4- 
close to Pa-.b,5 in LOCC norm does not have a O (e -2 log 
extension. From this we can get that the solution of the SDP 
(Q will be smaller than 1 — f2(e). Indeed suppose it were 
not the case and that the solution was larger than 1 — ce 
(for sufficiently small c > 0). Then because we are guar- 
anteed to be at most v away from the exact solution of 
Q, this would imply there is a positive semidefinite ma- 
trix Y A -.B 1 --B k such that Y a -.b 3 < Pa-.b.s for every j G [fc] 
and tr(Y) > 1 — (ce + u). We can symmetrize the B sys- 
tems in Y A: b 1 .--b i . to obtain a semidefinite positive matrix 
Za-.Bx- --B k , symmetric under the exchange of the B systems 
and such that Za-.b x < Pa.b,s and tr(Z) > 1 — (ce+v). Defin- 
ing aA-.B t ---B k = Z/ tr(Z), we find cfa-.b^ to be fc-extendible 

With OA:B x < (1 + 2(C£ + v))pA:B,S, SO \\o~A:B 1 ~ PA:B,s\\l < 

4(ce + v). But this is a contradiction, since we found be- 
fore that the e/4-ball around pa-.b,s does not contain any 
fc-extendible state. Because fc == 0(e -2 log | A\), the compu- 
tational cost of solving the ellipsoid algorithm with accuracy 
v = exp(-|A||B|e" 2 ) is 

polylog(l/0 poly(|A||B| fc ) 

= exp (0(e~ 2 log |A| log + C>(log(|A| \B\<T X ))) 
= exp(0(e- 2 log|A|log|S|))). 



We now prove that J- v is nonempty. This follows from the 

fact that TA:B ± -B h '■= \TA:B X ---B k £ T„, where TA:B 1 - -B k ■= 

I/\A\\B\ k the maximally mixed state. Indeed, it is clear that 
TaiSj. --B k + H > for every 



\H\\ 



< \\H\\ a <exp(-|A||B|e- 



Moreover, TA-.B-i---B k — H > which immediately implies 

that tl Ba -B h {T + H)< tTB 2 -B h (2T) < p A :B,6- □ 

Proof of Theorem Let £ k be the set of fc-extendible 
states. Let us first analyze the case in which M is such 
that {M,I - M} is LOCC. Then the inclusion 5 C £ k and 
Theorem [3] give 



maxtr(pAf) 



> maxtr(crM) 



> maxtr(pM) - ^JO (fc- 1 log \A\). 



Hence choosing fc — 0(e~ 2 log \A\) we can compute an e- 
error additive approximation to BSS(e) by solving the semidef- 
inite program given by maximizing tr(Mp) over fc-extendible 
states, whose time-complexity is exp (O (e -2 log \A\ log | B\ ) ) . 
This proves the first part of the theorem. 

To obtain the bound for general Af , note that 

\ti(M(p-a))\ < ||M|| a ||p-ff|| a 

by the Cauchy-Schwarz inequality. Therefore 

maxtr(pM) > maxtr(aM) 



> maxtr(pM) - ||M|| 2 log 
t>e£ k 

Then choosing k = 0(e~ 2 log |^4|||M|||) we can obtain an 
e-error additive approximation to BSS(e) by solving a SDP 
of time-complexity exp (O (e" 2 ||M||| log \A\ log \B\)) □ 

Proof of Theorem Q] We start by proving Eq. ©. Con- 
sider a protocol in QMA LO cc(2)m,s, c given by the LOCC 
measurement {Af, 1—M}. We construct a QMA ( m 2 f -!^ s+£1 , 
protocol that can simulate it: The verifier asks for a proof of 
the form \'4>)a:b 1 - --B k where \ A\ — \Bj\ — 2 m (each register 
consists of m qubits) and k = f2(me -2 ). He then sym- 
metrizes the B systems obtaining the state pA-.B 1 --B k and 
measures {M, I — Af} in the subsystems AB\. 

Let us analyze the completeness and soundness of the pro- 
tocol. For completeness, the prover can send |V ) )a ® \4>)% k > 
for states \tp), \<f>) such that tr \<t>){4>\ ® \ip){ip\M > c. Thus 
the completeness parameter of the QMA protocol is at least 
c. 

For soundness, we note that ||/9A:Bi — < S|| L0CC < e by The- 
orem [3] Thus, as {M, 1— M} C LOCC the soundness pa- 
rameter for the QMA protocol can only be e away from s. 
Indeed, for every pA-.B x ---B k symmetric in the B systems, 

tr(pA:Si M) < maxtr(Afa) + \\pa-.b 1 — 5|| L0CC < s + e. 

Eq. @ follows from the protocol above. Given a protocol 
in QMA LO cc(^) with each proof of size m qubits we can sim- 
ulate it in QMA LO cc(^ — 1) as follows: The verifier asks for 
I— 1 proofs, the first proof consisting of registers AB\ ■ ■ ■ B k , 
each of size m qubits and k = S7(me~ 2 ), and all the 1—2 
other proofs of size m qubits. Then he symmetrizes the B 
systems and traces out all of them except the first. Finally 
he applies the original measurement from the QMA LO cc(^) 
to the resulting state. 



The completeness of the protocol is unaffected by the sim- 
ulation. For the soundness let pAB x - B k ® 03 ® ■ • ■ ® <t; be 
an arbitrary state sent by the prover (after symmetrizing 
B 1 , . . . , B m )- Let {Af, I — M} C LOCC be the verification 
measurement from the QMA LO cc(0 protocol. Then 



tr {A{pAB 1 
< 



03 ( 



max 

tr6S(l:2:-- 



•••®<n)) 

tr(Mc) 



+ min \\pAB 1 



— max 

ct£S(1:2:-- 

< s + e, 



CT 3 « • • • 69 m - cr|| L 0CC 
tr(Mcr) + min \\pab x - cr|| L occ 



The equality in the second line follows since we can assume 
that the states 0-3, . . . , a t belong to the verifier and adding 
local states does not change the minimum LOCC-distance 
to separable states. 

Since for going from QMA L0C cM to QMA L0CC (^ - 1) we 
had to blow up one of the proof's size only by a quadratic 
factor, we can repeat the same protocol a constant num- 
ber of times and still get each proof of polynomial size. In 
the end, the completeness parameter of the QMA procedure 
is the same as the original one for QMA LO cc(^)> while the 
soundness is smaller than s + £e, which can be taken to be 
a constant away from c by choosing e sufficiently small. To 
reduce the soundness back to the original value s we then 
use the standard amplification procedure for QMA (see e.g. 
[33]). which works in this case since the verification mea- 
surement is LOCC [I]. □ 

Proof of Theorem The proof is very similar to the 
proof of Theorem [4] so we only comment on the differ- 
ences. The strategy for simulating a QMA LO w,no(2) protocol 
in QMA is the same as before: The verifier asks for a proof of 
the form A-.Bi---B k where \A\ — \Bj\ — 2 m (each register 
consists of m qubits) and k — poly(n)e -2 . He then sym- 
metrizes the B systems to obtain the state pA-.B t —B k , and 
measures {Af, I— Af} in the subsystems AB\. The complete- 
ness of the QMA protocol is the same as that of the original, 
since the prover can send a ® \4>) < B k ■ 

For analyzing the soundness of the protocol, let a be the 
closest separable state to pa-.b x in Euclidean norm. Eq. |T} 
gives 

\\PA-. B1 - *h < O^-Mogl^l)* = l/poly(n). 

Then, by the Cauchy-Schwarz inequality, 

|tr((pA:B! -a)M x )\ < \\p A :B 1 -cr||2]|M x ||2 < l/poly(n). 

The proof for QMA L ow,no(&) for fc > 2 is completely analo- 
gous to the proof of Theorem [4] 

A last point to argue is the converse relation, namely that 
QMA is contained in QMA LO w.no(2). This follows from the 
QMA error reduction protocol of Marriot and Watrous [29] . 
Indeed, they showed how any protocol in QMA can be trans- 
formed into a protocol with proof size n equal to the orig- 
inal proof size and soundness 2- poly(n) . This means that 
for "no" instances the associated measurement M x must be 
such that ||M X || 2 < 2 n ||Af a: || 00 < 2- poly ( n >, from which fol- 
lows that the protocol is in QMA LO w,no(2). □ 

Proof of Theorem [H] (outline). The proof of Theo- 
rem [6] begins by first chaining together three inequalities 
(Lemmas [1] [2] and [3] below) , each of which is a new result 



in entanglement theory and is of independent interest. A 
recursive step (Lemma [4] below) completes the proof. These 
same lemmas appear in [B] with complete proofs; here we 
only outline these proofs. 

The first step involves an entanglement measure called the 
regularized relative entropy of entanglement [32] , defined as 



Er (pa-.b) 



lim -E R (p 

n— >oo n 



A:B), 



where Er(pa-.b) = mhio-gs S(p||<r) is the relative entropy of 
entanglement, and where S(p\ \o) = tr(p(log p— log a)) is the 
quantum relative entropy. 

A distinctive property of the relative entropy of entangle- 
ment among entanglement measures is the fact that it is not 
"lockable," meaning that after discarding a small part of the 
state, Er can only drop by an amount proportional to the 
number of qubits traced out. Indeed, as shown in 22 , 



Er( P a:be) < ER(p A : E ) + 2S(B) p . 



(5) 



While the same is true for Er, we prove the following 
stronger version: 



Lemma 1. For every pabe, 

I(A;B\E) > E% (pa-.be) 



Er(pa-.e). 



Proof (outline). This lemma follows by combining the 
inequality ([5]) with an optimal protocol for the following mul- 
tipartite quantum data compression problem 35 . Consider 
many copies of a pure statq3 on ABEE' whose restriction to 
ABE is pab e ■ Suppose these states are shared between two 
parties: a sender, who holds BE, and a receiver, who holds 
E' , while A is inaccessible to both. The state redistribution 
problem asks the sender to use quantum communicatiorF^I to 
transfer the B system to the receiver, while asymptotically 
preserving the overall global quantum state. A protocol for 
state redistribution was given in [35] achieving the optimal 
communication rate of \l(A; B\E), providing an operational 
interpretation for quantum conditional mutual information. 
The proof of Lemma [T] is obtained by carefully using the 
state redistribution protocol to apply the inequality ([S| to a 
tensor-power state p® n in the most efficient way. □ 

Next, we recall a recent operational interpretation of Er 
in the context of quantum hypothesis testing [7|. Suppose 
Alice and Bob are given either n copies of an entangled state 
Pa-.b, or an arbitrary separable state across A n : B n . Then 
we define -Dm (pas) to be the optimal error exponent for 
distinguishing between these two situations, using only mea- 
surements from the class M. Specifically, let 

p e (n) — min max tr(Ma), 

where the minimization is over all measurements M £ M 
identifying p®£ with asymptotically unit probability: 

lim tr(Mp%) = 1. 



12 A pure state is a rank 1 density matrix. A basic theorem 
in quantum information asserts that every density matrix 
Pa can be expressed as the partial trace of a pure state on 
a larger system AB. 

13 The sender and receiver are also allowed to utilize shared 
entanglement between themselves to accomplish this task. 



Dm(pa-.b) ■= lim 



logp e (n) 



The main result of [7] gives the following equality 
Dall(pa-.b) = Er (pa-.b), 



(6) 



i.e. the regularized relative entropy of entanglement is the 
optimal distinguishability rate when trying to distinguish 
many copies of an entangled state from (arbitrary) separa- 
ble states, in the case where there is no restrictions on the 
measurements available. 

Define LOCC^ in analogy to LOCC, using only measure- 
ments that can be implemented by one-way LOCC, i.e. by 
any protocol formed by local operations and classical com- 
munication only from Bob to Alice. Then we have: 

Lemma 2. For every pabe, 

Er(pa-.be) - Er(pa-.e) > A_occ+- (pa-.b)- 



Proof (outline). The lemma follows by using Eq. (0 
and further developing the connection with hypothesis test- 
ing in the form of a new monogamy-like inequality for Er°: 



Er(pa-.be) - Er(pa-.e) = 
> 



E>M_\_(pA:BE 
A_OCC<- (pA:B 



- D ALL (pa-.e) 



This inequality is proved by using measurements that achieve 
Da\_\_(pa-.e) and -Dlocc<- (pa-.b) to construct a global mea- 
surement distinguishing pabe from separable states Sa-.be 
at a sufficiently good rate. □ 

We define in analogy to the LOCC norm, the one-way 
LOCC norm || * ||locc^ , in which only measurements imple- 
mentable by LOCC~ are allowed. Then next step is to con- 
vert the entropic bound on I(A;B\E) obtained from Lem- 
mas [1] and [2] into a lower bound in terms of the minimum 
LOCC^ distance to the set of separable states: 

Lemma 3. For every pab, 

1 i|2 
-DL0CC-(pA:i3) > ^^WPA-.B - Sa-.b\\ locc ^. 



Proof (outline). This follows from a combination of 
von Neumann's minimax theorem and Azuma's inequality, 
since separable states satisfy a martingale property when 
they are subject to local measurements. □ 

So far, Lemmas 1,2 and 3 combine to give 



I(A;B\E) > 

> 

> 



Er(pa-.be) - Er(pa-.e) 

D\_occ^- (pa-.b) 
i 

Sa-.b 



8 In 2 



\pA:B 



2 

LOCC+ 



We now consider the family of norms 



LOCC(fe)' 



which 



quantify distinguishability with respect to measurements that 
can be implemented by k rounds of LOCC. In particular, 
they satisfy LOCC^ = L0CC(1) and LOCC = U fe LOCC(fc). 
Theorem 1 follows by recursive application of the following 
technical lemma, which is proved in [6]: 



Lemma 4. Assume that 

I(A;B\E) > — !— I 
v ' 1 ; - 81n2' 



pA:B — Sa-.. 



iLOCC(fc-l)' 



Then 



/( ^ ;jB|jB) " ^lbll^ S " 5A:S llL0CC W - 



□ 
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